All suspicious files that do not have their hash value in the FortiGuard antivirus signature database.

All suspicious files that are above the defined oversize limit value in the protocol options.

All suspicious files that match patterns defined in the antivirus profile.

All suspicious files that are allowed to be submitted to FortiSandbox in the antivirus profile.